EX280 Practice Test 9 — 10 Questions

Question 1

You need to create a Role that allows reading and writing ConfigMaps and Secrets only within the 'database' project. Which API groups and resource types should be included in the rules?

Accepted Answer

apiGroups: [''], resources: ['configmaps', 'secrets'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete']. ConfigMaps and Secrets belong to the core API group, represented as an empty string ('') in RBAC rules. The correct verbs for read and write access are get, list, watch (read) and create, update, patch, delete (write). This Role, when bound within the 'database' project via a RoleBinding, grants the intended permissions.

Answer

apiGroups: ['rbac.authorization.k8s.io'], resources: ['roles', 'rolebindings'], verbs: ['*']

Answer

apiGroups: [''], resources: ['pods/exec'], verbs: ['create']

Answer

apiGroups: ['apps'], resources: ['configmaps', 'secrets'], verbs: ['*']

Question 2

Which THREE troubleshooting steps should an administrator take when a newly created Route fails to resolve or connect? (Choose THREE)

Accepted Answer

Check that the Route hostname resolves correctly via DNS to the cluster router IP.. Option B is correct because a Route only works if its hostname resolves via DNS to the cluster's router (Ingress controller) IP; if DNS points elsewhere or does not resolve, clients cannot reach the route. Option C is correct because a Route forwards to a Service, and if that Service has no active endpoints (e.g., selector mismatch or unready pods), the router returns 503 and the route appears broken. Option D is correct because the Ingress controller operator/router logs record routing errors such as missing TLS secrets, invalid route admission, or backend failures, making them the primary diagnostic source. Option A is wrong because reinstalling the entire cluster storage operator is unrelated to Route resolution and would not fix DNS, Service, or router issues. Option E is wrong because modifying kube-apiserver certificates is a destructive, unrelated action that does not affect Route hostname resolution or backend connectivity.

Answer

Reinstall the entire cluster storage operator.

Answer

Modify the cluster kube-apiserver certificates.

Question 3

An administrator has modified a KubeletConfig resource to adjust the pod eviction thresholds on worker nodes. After applying the change, the administrator observes that some worker nodes are updating while others belonging to a custom worker pool are not. What is the most likely reason?

Accepted Answer

The KubeletConfig's machineConfigPoolSelector does not match the labels on the custom MachineConfigPool.. The KubeletConfig resource uses a machineConfigPoolSelector to target specific MachineConfigPools (MCPs). If the selector does not match the labels on the custom worker pool's MCP, the KubeletConfig will not be applied to nodes in that pool. This is the most likely reason why some nodes update while others do not.

Answer

KubeletConfig objects are only supported on control plane nodes in OpenShift 4.14.

Answer

The cluster storage size is insufficient to hold the new kubelet configuration.

Answer

The kubelet service must be manually restarted on every node using SSH.

Question 4

Which SCC is assigned by default to authenticated users who are not service accounts?

Accepted Answer

restricted. In OpenShift, authenticated users who are not service accounts are automatically granted the 'restricted' SCC (and in newer versions restricted-v2) via the system:authenticated group binding. This is the default least-privilege SCC that allows pods to run without root, with dropped capabilities. It is assigned by the cluster's default SCC admission configuration, not by any user action.

Answer

anyuid

Answer

nonroot

Answer

privileged

Question 5

A DeploymentConfig in OpenShift has a Rolling strategy defined. Which parameter in the strategy configuration controls the maximum number of pods that can be created above the desired replica count during the update?

Accepted Answer

maxSurge. In OpenShift's DeploymentConfig Rolling strategy, maxSurge specifies the maximum number of pods that can be created beyond the desired replica count during an update. This allows the deployment to temporarily exceed the desired number of replicas to ensure zero downtime. For example, if replicas=3 and maxSurge=1, the deployment can have up to 4 pods at once. This parameter is defined in the strategy's rollingParams section.

Answer

interval

Answer

updatePeriodSeconds

Answer

maxUnavailable

Question 6

A system administrator needs to revoke the 'admin' role from user 'bob' in the 'finance' project without deleting the project or affecting other users. Which command should be used?

Accepted Answer

oc adm policy remove-role-from-user admin bob -n finance. The correct command to revoke a role from a user in a specific project is 'oc adm policy remove-role-from-user admin bob -n finance'. This command removes the role binding that grants the 'admin' role to user 'bob' in the 'finance' namespace, without affecting other users or the project itself.

Answer

oc revoke role admin bob --namespace=finance

Answer

oc delete user bob -n finance

Answer

oc remove-user bob --project=finance

Question 7

A cluster administrator has deleted a PersistentVolumeClaim, but the underlying PersistentVolume still exists in the cluster with a Released status and its data remains intact on the storage backend. What is the most likely cause of this behavior?

Accepted Answer

The persistentVolumeReclaimPolicy of the PersistentVolume was set to Retain.. When a PVC is deleted, the PersistentVolume's reclaim policy determines what happens to the underlying storage. If the PV's persistentVolumeReclaimPolicy is set to Retain, the PV transitions to Released status and the data on the backend is preserved; the PV must be manually reclaimed or deleted by an administrator. This exactly matches the described behavior.

Answer

The StorageClass associated with the PV has allowVolumeExpansion set to false.

Answer

The volume access mode was configured as ReadWriteMany instead of ReadWriteOnce.

Answer

The PVC was protected by a finalizer that prevented immediate deletion.

Question 8

Which tool would you use to package an application including its dependencies and configuration for easy distribution in OpenShift?

Accepted Answer

Helm. Helm is a package manager for Kubernetes/OpenShift that bundles application manifests, dependencies, and configuration into a single chart for easy distribution and versioned installation. It supports templating, values files, and dependency management, making it the standard tool for packaging and distributing applications. The other options are build or configuration tools, not packaging/distribution tools.

Answer

oc build

Answer

Kustomize

Answer

S2I

Question 9

You need to ensure that a specific ServiceAccount named 'builder-sa' in the 'cicd' project can use the 'privileged' SecurityContextConstraints. Which command accomplishes this?

Accepted Answer

oc adm policy add-scc-to-user privileged system:serviceaccount:cicd:builder-sa. `oc adm policy add-scc-to-user privileged system:serviceaccount:cicd:builder-sa` is the correct command to grant the 'privileged' SCC to the 'builder-sa' ServiceAccount in the 'cicd' project. It adds the ServiceAccount to the SCC's users list, allowing pods running as that SA to request privileged access.

Answer

oc annotate serviceaccount builder-sa scc=privileged -n cicd

Answer

oc set scc privileged --serviceaccount=builder-sa -n cicd

Answer

oc create rolebinding privileged-binding --clusterrole=privileged --serviceaccount=cicd:builder-sa

Question 10

A user creates a PVC, but the storage backend fails to provision the volume. Where can the administrator look to find detailed error messages emitted by the external provisioner controller?

Accepted Answer

Review the logs of the CSI external provisioner controller pod in its management namespace.. When a PVC fails to provision, the external provisioner sidecar (e.g., csi-provisioner) running alongside the CSI driver controller is the component that actually calls the storage backend's CreateVolume API and logs the resulting errors. In OpenShift, CSI controller pods run in the driver's management namespace (typically openshift-cluster-csi-drivers or the operator's namespace), so reviewing that pod's logs reveals the detailed backend error messages.

Answer

Run 'oc adm diagnostics storage'.

Answer

Inspect the container image registry logs.

Answer

Check /var/log/messages on the control plane nodes.